Article 30 records for controllers and processors – a summary register, detailed activity sheets with a worked example, and a processor record for organisations that process data for clients.
Data protection & GDPR
Record of Processing Activities (ROPA)
About this document
The written record of your processing activities that Article 30 of the UK GDPR requires. It lists what personal data you hold, why, on what lawful basis, who you share it with, transfers, retention and security. It is the backbone of your data protection compliance – privacy notices, retention schedules and DPIAs should all match it – and it is one of the first documents the regulator asks to see.
The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.
Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.
Included in the pack
Data protection & GDPR
for every document in this category
Editable Microsoft Word files
Guidance notes in every document
Written for UK businesses
Download and keep
Need more than one category?
Documents All-Access gives you every category for 12 months for £295.
Compare options →Need it tailored?
We can adapt any template to your business, or write a document from scratch.
Talk to us →
